- Daiichi Kosho says malware on one PC at contractor Nippon Columbia Group may have exposed about 8,724,000 customer records. No leak or misuse is confirmed.
- Daiichi Kosho says it has confirmed no impact on its own systems and is checking them as a precaution. The data at risk was temporarily held on a vendor's PC.
- Leaders should ask each vendor where copies of customer data sit, how long they stay, and how fast the vendor must report an infection.
Daiichi Kosho says it has found no impact on its own systems. Its customers may still be exposed.
Daiichi Kosho runs Big Echo and other karaoke brands in Japan. It says it has not confirmed any impact on its own systems, and it is inspecting them as a precaution. Yet about 8.7 million records may now be at risk.
The lesson here is that the unit of risk is the copy, not the company. Your security perimeter ends where your data stops being. If a copy of it sits on someone else's PC, that PC is part of your perimeter, whether or not your contract says so.
What Daiichi Kosho says happened
Daiichi Kosho outsources the handling of personal information to Nippon Columbia Group, or NCG. NCG told it that malware had infected one employee's PC. NCG found the infection on October 1 and 2 and took the PC off its network on October 2.
Daiichi Kosho heard about it on October 5. That is three days after the PC was isolated. By then NCG had done an initial assessment of the affected data, though it says its investigation of cause and scope is still open.
The key detail is where the data was. Daiichi Kosho says the PC temporarily held personal data tied to the work it had outsourced. It cannot rule out that this data leaked.
What data is involved, and what is not known
For customers who registered or booked at its stores, the records may include registered name, gender, date of birth, email address and phone number. The notice says passwords are not included. It also says this data alone cannot be used to spend loyalty points.
BleepingComputer reports the total as 93,000 employee records and 8,631,000 customer records. Daiichi Kosho's notice describes the 8,724,000 figure as customer information, so the split comes from the coverage.
Daiichi Kosho has not confirmed any leak or misuse. NCG says it has reset passwords and other credentials. Its investigation is still open on the cause, the scope and whether any data was leaked. The notice does not say what kind of malware it was or how it got onto the PC.
On its own side, Daiichi Kosho says it has found no impact on its systems. It is checking them anyway, as a precaution. That is a statement about the findings so far, not a final all-clear.
BleepingComputer could not find a public statement from NCG and has asked the company for comment. Daiichi Kosho's notice says it will announce new findings promptly.
Why a temporary copy matters
Think of a bank that hires a courier. The vault may be sound, but the parcel is only as safe as the courier's bag. In effect, the "parcel" here was a temporary holding of customer data, apparently a copy made for the vendor's work.
Temporary copies tend to sit outside the controls that protect the main system. This is our interpretation, and the sources do not say how NCG's PC was managed. But the facts fit the pattern. One ordinary work device held millions of records, and a single infection put them in question.
The data types matter too. Daiichi Kosho's own notice warns that exposed details could be used for impersonation emails and phishing. A message that knows your name, birth date and phone number looks more convincing. The people carrying that risk are customers who never chose NCG and may not know it exists.
Questions to put to your team
Daiichi Kosho says it is reviewing how it manages its contractors. Any organisation can ask the same questions now.
First, which vendors hold copies of our customer or employee data, and on what kinds of devices? Second, how long do those copies stay, and who deletes them? Third, how fast must a vendor tell us about an infection? In this case the gap between isolation and notification was three days.
Fourth, can the vendor tell us, record by record, what was on a device? Daiichi Kosho could name a figure, but NCG is still investigating whether any data left the PC. Finally, does our contract let us audit the vendor's practices, rather than only trust them?
You can outsource the work. You cannot outsource the customer's trust, and the customer will blame the name on the storefront.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Daiichi Kosho.
